Computer user(s) are inundated with prompts to enter credentials to authenticate themselves for access to such things as email, bank accounts, subscription websites, and online chat services. Credentials (e.g., passwords, PINs, etc) are conventionally collected in an insecure environment (e.g., user's desktop) which is vulnerable to spoofing and hooking attack(s). Conventionally, user(s) enter these credentials into whatever prompt is presented without a way to tell who or what is actually requesting the credentials. For example, a simple manipulation of the user interface can make any prompt look like it is coming from someone or something the user trusts. This makes it trivial for a ‘spoofing’ application to collect credentials from a user without their knowledge.
Further, conventionally, credentials stored for a user can be retrieved by applications running under the user's context without his knowledge. While this contributes to the single sign on approach, certain sensitive credential(s) (e.g., bank account number) can implicate stronger controls for security purposes.